Google PCA Practice Test 29 — 15 Questions

Question 1

A security engineer wants to ensure that all admin activity in their GCP organization is logged and retained for 3 years. They also need to be alerted if a new firewall rule is created. Which logs should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all administrative actions that modify configuration or metadata in GCP, including creating firewall rules, changing IAM policies, and modifying resources. They are always enabled and retained, but to retain for 3 years you must route them to a log sink (e.g., Cloud Storage or BigQuery) with a retention policy. Alerting on new firewall rule creation is done via a log-based alert on the Admin Activity log for compute.firewalls.create.

Answer

Data Access audit logs

Answer

VPC flow logs

Answer

Cloud DNS logging

Question 2

A team uses Cloud Build for CI/CD. The builds are taking longer than expected due to dependency downloads. What is the best practice to speed up builds?

Accepted Answer

Use Docker layer caching with Cloud Build by specifying a cache image or using Kaniko cache.. Docker layer caching allows Cloud Build to reuse previously built layers, significantly reducing the time spent re-downloading and re-installing dependencies. By specifying a cache image or using Kaniko's built-in cache, only changed layers are rebuilt, while unchanged dependency layers are pulled from the cache instead of being fetched from the internet each time.

Answer

Increase the machine type to e2-highcpu-32 to speed up compilation.

Answer

Use Artifact Registry to store built packages and pull them during build.

Answer

Store dependencies in Cloud Source Repositories and fetch them during build.

Question 3

A financial services firm runs batch risk calculations nightly using a large Compute Engine VM with a GPU. Jobs complete in 4 hours but are not time-sensitive. To reduce costs without sacrificing reliability, the firm enables preemptible VMs but finds that jobs are interrupted and restarting from scratch causes delays. What is the best approach to improve reliability while maintaining cost savings?

Accepted Answer

Use a managed instance group with preemptible VMs and implement checkpointing to save progress periodically.. Preemptible VMs are up to 80% cheaper but can be terminated at any time with only a 30-second warning, so long-running jobs must be resilient to interruption. Combining a managed instance group (MIG) with preemptible VMs allows automatic recreation of terminated instances, and implementing checkpointing lets the batch job resume from the last saved state rather than restarting from zero. This preserves the cost savings while dramatically improving reliability for the 4-hour nightly job.

Answer

Request a committed use discount for the GPU and use a standard VM without preemptible.

Answer

Use a non-preemptible VM but downgrade the GPU type to reduce cost.

Answer

Use a spot VM with a high availability SLA, relying on low preemption rates.

Question 4

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

Accepted Answer

Organization policy with a list constraint.. Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess to require uniform bucket-level access. Option B (IAM roles with custom permissions) cannot deny bucket creation with specific settings. Option C (Cloud Audit Logs) is for logging, not enforcement. Option D (Cloud Armor) is for security policies at the edge.

Answer

IAM roles with custom permissions to deny bucket creation.

Answer

Cloud Audit Logs to monitor bucket creation.

Answer

Cloud Armor security policies.

Question 5

Drag and drop the steps to configure IAM roles for a service account to access Cloud Storage from a Compute Engine instance into the correct order.

Accepted Answer

Create the service account, then grant the necessary IAM roles, then attach the service account to the Compute Engine instance.. The service account must be attached to the instance before it can be used. Granting roles is done on the service account.

Answer

Grant the necessary IAM roles, then attach the service account to the Compute Engine instance, then create the service account.

Answer

Attach the service account to the Compute Engine instance, then create the service account, then grant the necessary IAM roles.

Answer

Create the service account, then attach it to the Compute Engine instance, then grant the necessary IAM roles.

Question 6

An organization uses Active Directory (AD) on-premises. They want to synchronize user accounts and groups to Google Cloud Identity so that users can sign in with their existing AD credentials. Which service should they use?

Accepted Answer

Google Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users, groups, and other directory data from an on-premises Active Directory or LDAP directory to Google Cloud Identity or Google Workspace. It runs on-premises, reads from AD, and provisions accounts in Google Cloud, allowing users to sign in with their existing AD credentials (often via SAML federation or password sync).

Answer

Cloud Identity Platform

Answer

Cloud Identity-Aware Proxy

Answer

Security Command Center

Question 7

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Ensure the health check path specified in the backend service returns a 200 OK status.. Option A is correct because the health check probe only marks an instance healthy when the configured request path returns an HTTP 200 OK response; if the path returns 404, 500, or a redirect, the instance will be flagged unhealthy, so verifying the path is a primary troubleshooting step. Option B is correct because Google Cloud external HTTP(S) load balancer health checks originate from specific Google health check source IP ranges (e.g., 35.191.0.0/16 and 130.211.0.0/22), and firewall rules must permit ingress from these ranges to the instances on the health check port, otherwise probes are dropped and instances fail. Option C is not relevant because session affinity affects how client traffic is routed, not whether health check probes succeed. Option D is not a fix because lengthening the interval only delays detection and does not resolve the underlying cause of failed probes. Option E is not appropriate because adding instances does not correct failing health checks and may simply add more unhealthy instances.

Answer

Disable session affinity to allow better distribution of traffic.

Answer

Change the health check interval from 5 seconds to 30 seconds.

Answer

Increase the number of instances in the instance group to distribute the load.

Question 8

A company wants to deploy a containerized application on Google Cloud and needs persistent storage that can be accessed by multiple pods in a GKE cluster concurrently. Which storage solution should they use?

Accepted Answer

Filestore. Filestore is the correct choice because it provides a managed NFS file server that supports the ReadWriteMany (RWX) access mode, allowing multiple pods in a GKE cluster to concurrently read from and write to the same persistent storage volume. This is essential for workloads like content management systems or shared data processing that require simultaneous access from multiple pods.

Answer

Persistent Disk with ReadWriteMany access mode

Answer

Cloud Storage via Storage FUSE

Answer

Compute Engine persistent disk attached to each node

Question 9

A company needs to retain object versions in Cloud Storage for 90 days to protect against accidental deletion or modification. After 90 days, versions should be deleted. What feature should they enable?

Accepted Answer

Object lifecycle management with a rule to delete versions after 90 days. Object Lifecycle Management lets you define rules to automatically delete object versions after a specified age (90 days). Combined with Object Versioning enabled on the bucket, this retains noncurrent versions for 90 days and then deletes them, protecting against accidental deletion or modification while controlling storage costs.

Answer

Object versioning only

Answer

Retention policy

Answer

Object holds

Question 10

A company wants to grant a service account in Project A the ability to push containers to Artifact Registry in Project B. They want to follow the principle of least privilege. Which IAM roles should they assign?

Accepted Answer

Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. The Artifact Registry Writer role (roles/artifactregistry.writer) grants permissions to push and pull artifacts, which is exactly what the service account needs to push containers. Assigning it at the repository level in Project B follows least privilege by limiting access to only that repository. This role includes the necessary permissions like artifactregistry.repositories.uploadArtifacts without granting broader admin rights.

Answer

Grant the service account the Storage Object Admin role (roles/storage.objectAdmin) on Project B

Answer

Grant the service account the Artifact Registry Admin role (roles/artifactregistry.admin) on the repository in Project B

Answer

Grant the service account the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in Project B

Question 11

A developer runs the command above. The instance is created successfully, but cannot be reached via HTTP from the internet. What is the most likely cause?

Accepted Answer

There is no firewall rule allowing ingress traffic on ports 80 and 443.. The most likely cause is that there is no firewall rule allowing ingress traffic on ports 80 and 443. By default, Google Cloud Platform (GCP) firewall rules block all incoming traffic from the internet. Even though the instance is created successfully, HTTP/HTTPS traffic cannot reach it unless a firewall rule explicitly permits ingress on TCP ports 80 and 443, typically via a target tag like 'http-server' or 'https-server'.

Answer

The machine type n1-standard-2 is not suitable for HTTP.

Answer

The image family debian-10 does not support HTTP.

Answer

The boot disk type pd-standard is too slow.

Question 12

Your team has deployed a microservices application on Google Kubernetes Engine (GKE) with multiple services communicating via internal ClusterIP services. You notice that some requests between services are failing intermittently with 'connection refused' errors. The services are defined with readiness probes. What is the most likely cause?

Accepted Answer

The readiness probes are not passing, causing the service endpoints to be removed.. The 'connection refused' error indicates that the client is attempting to connect to a port on which no process is listening. In GKE, when a readiness probe fails, Kubernetes removes the pod's IP from the corresponding ClusterIP service's endpoints. If all pods for a service fail their readiness probes, the service has no healthy endpoints, and any request to the ClusterIP will be refused because there is no backend to accept the connection. This matches the intermittent nature of the issue, as pods may temporarily fail the probe and then recover.

Answer

The services are not exposed via a VPC peering connection to the client's VPC.

Answer

The services are using NodePort instead of LoadBalancer type, causing port conflicts.

Answer

The services are not associated with an Ingress resource.

Question 13

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

Accepted Answer

Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.. The issue is specifically with Cloud Spanner query latency under high load. Enabling interleaved tables and adding secondary indexes optimizes data locality and query performance, reducing the need for expensive cross-table joins and full table scans. This directly addresses the root cause of increased latency and timeouts in the catalog service.

Answer

Use Cloud CDN to cache product catalog responses.

Answer

Increase the number of nodes in the GKE node pool.

Answer

Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.

Question 14

Match each GCP migration term to its description.

Accepted Answer

Migrate for Compute Engine: Migrates virtual machines to Compute Engine with minimal downtime.. Correct matches: Migrate for Compute Engine migrates VMs; Cloud Storage Transfer Service handles online data transfers; Transfer Appliance is a physical device for large datasets; Database Migration Service migrates databases to Cloud SQL. Common confusions include swapping the roles of these services.

Answer

Migrate for Compute Engine: Transfers data from online sources to Cloud Storage.

Answer

Cloud Storage Transfer Service: Physical device to transfer large datasets to Google Cloud.

Question 15

A company wants to migrate its on-premises monolithic application to Google Cloud with minimal changes. They plan to run it on a virtual machine with a predictable workload that runs 24/7 for a one-year commitment. Which compute option is MOST cost-effective?

Accepted Answer

Committed use discounts. Committed use discounts (CUDs) provide significant discounts (up to 57% for most services) in exchange for committing to a specific amount of resources for a 1- or 3-year term. For a predictable, 24/7 workload running for one year, CUDs are the most cost-effective option because they offer a lower price than on-demand and do not carry the risk of interruption like Spot or Preemptible VMs. Spot VMs are cheaper but can be preempted, making them unsuitable for a steady, always-on application.

Answer

Spot VMs

Answer

On-demand VMs

Answer

Preemptible VMs